About robin272

robin272 · ‎04-02-2020

I indexed data from a local directory. All of them are Web Access Logs so I set the sourcetype to access_combined. As I run my search (I'm only searching for the source), I get 0 events in return. I once had the same source indexed but deleted it. I deleted the indexed data and the data source. The data input recognizes the 9 files that the directory contains but the search doesn't find events. I don't know why and have no idea what to do. I have already restarted Splunk and deleted the indexed data and the data input but nothing works.

robin272 · ‎03-09-2020

Thanks. I thought that SSE is a complete framework that analyzes the indexed data automatically. It's more like a recipe book, with common use cases which one can individually edit for the specific data. I don't know if I haven't seen them, but are there use cases for sourcetype "access_combined(_wcookie)"? I found this add-on for access logs: https://splunkbase.splunk.com/app/3186/#/overview But does SSE have own use cases for this sourcetype respectively use cases that you can use on this sourcetype? I didn't find any so far.

robin272 · ‎03-05-2020

Even here, every use case fails. The source type is "access_combined_wcookie". I try to use the use case "First Time Accessing an Internal Git Repository". The data check "Must have BitBucket / Git data" says "In tests so far, Atlassian BitBucket git logs are stored in a file called atlassian-bitbucket-access.log. We're looking for that here.". The data check "Must have a user defined in your data" says "You should have a field called "user" defined in your bitbucket logs. If that's not currently extracted, build an extraction for it (or do an inline rex in the SPL below to work around this).". I have Bitbucket Logs indexed and I have a field called user, but both checks fail. How can I get the use case to become successful?

robin272 · ‎03-04-2020

I'm using Splunk Enterprise with a developer license. I have log files on my computer (access and error logs). I successfully indexed them and I can do searches. I have Splunk Security Essentials installed and now I want to test the previously indexed data with the given use cases from Security Essentials. I read the docs and all other stuff I found on Google but I don't get it. When I try to use "Automated Introspection" in "Data Inventory", I get no results. When I try to use "Data Source Check", I get no results. I don't know what to do. My task is to apply the given use cases on the data from the access and error logs and to evaluate if they are usable in our context. Further on I have to create own use cases to get a large spread over many use cases. All of those must be based on Kill Chains and Mitre Att&ck. I have no idea how to solve my problem with the data and how to go on with my task. Thanks in advance.

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-04-2020

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Search shows 0 events

How to get data into Splunk Security Essentials?

Search shows 0 events

Re: How to get data into Splunk Security Essential...

Re: How to get data into Splunk Security Essential...

How to get data into Splunk Security Essentials?